Tencent's Zhuque Lab Open-Sources AI Agent/MCP Security Scanner

As AI agents increasingly create files, make reservations, and call external tools, the attack surface has spread from the model alone to agents, skills, and connection protocols. The recent release of OpenAI's cybersecurity-focused model GPT-5.6-Cyber, and the case where Zoom's screen-sharing feature was breached using fewer than 20 AI prompts, are part of the same context. These incidents showed that as AI features multiply, so do the paths that target those features. A.I.G takes the approach of turning this kind of threat into a routine inspection tool rather than a case-by-case incident response.

Five scanning functions

In its official documentation, A.I.G organizes its features into five areas. ClawScan (OpenClaw Security Scan) targets OpenClaw instances, while the other four handle agents, infrastructure, MCP servers, and jailbreak evaluation, respectively.

Function	Scan target	Method
ClawScan	OpenClaw instances	Diagnoses by connecting to the running service
Agent Scan	AI agents	Checks behavior and permission vulnerabilities
AI Infra Scan	Running AI services	Connects via network address to match against known CVE fingerprints
MCP Scan	MCP servers/source	Via remote URL or uploaded local source archive
Jailbreak Evaluation	LLM API endpoints	Runs evaluation after selecting a dataset

A notable feature of AI Infra Scan is that its target isn't a GitHub URL or a source code path, but the network address of an actually running service. For example, if you're running a vLLM instance locally, entering that address into A.I.G lets it automatically identify the version and cross-check it against known vulnerabilities.

A benchmark that splits skill security risk into nine categories

Alongside this scanner, Zhuque Lab also runs a benchmark called SkillTrustBench. It's a system that classifies the security risks of agent skills (external tools/plugins) into nine categories, T01 through T09, and A.I.G's vulnerability classification criteria follow this taxonomy. The lab says it publishes a leaderboard showing how risk-detection performance changes when the same skill is attached to different LLMs.

How to try it

For installation, the recommended method is a one-click installation script. Once deployment is complete, you can access the web interface by visiting localhost:8088 in a browser, and the API documentation is available at localhost:8088/docs/index.html. There's also a way to invoke it directly from within OpenClaw chat — after installing the aig-scanner skill, you just need to set the AIG_BASE_URL value to the address of the running A.I.G service.

However, Zhuque Lab made one point clear. A.I.G is designed for internal use by companies or individuals and does not yet have an authentication mechanism, so it should not be exposed as-is on the public internet. The default assumption is that it will be used behind a corporate network or firewall.

Besides the free version, there's also a Pro version with advanced features and performance, which requires an invite code and prioritizes people who submit issues or pull requests or otherwise contribute to the community.

Who built it, and their track record

Zhuque Lab is a research organization under Tencent's security platform division, established in 2019, and has worked on large model security, AI agent security, and AI-generated content detection. It states that it has discovered high-risk vulnerabilities in companies such as NVIDIA, Google, and Microsoft, as well as open-source communities like OpenClaw, Linux, and Hugging Face, and has received official audit credit from those organizations as a result. Its research has been presented at security and AI conferences including Black Hat, DEF CON, ICLR, CVPR, NeurIPS, and ACL, and its related paper has been cited by 19 external research papers.

Editor's view

What's interesting about this tool is the scan target list itself. A security scanner from a few years ago would have probed code vulnerabilities or network ports, but three of A.I.G's five pillars target not the model itself but the layers wrapped around it — agents, skills, and the MCP protocol. This signals that the attack surface has shifted. The model itself already undergoes safety testing at many companies, but the moment external tools get connected to that model, a new opening appears — and this looks like the industry belatedly catching on to that fact.

The practically notable point is that the developer itself explicitly warned against deploying the tool on a public network without authentication. As more teams domestically connect MCP servers or agent skills to internal systems, if even the security-checking tool itself lacks an authentication layer, that tool could become a new entry point. The right sequence is to first put basic measures in place — internal network isolation, deployment behind a VPN — before attaching a scanner like this.

In the coming months, attempts to embed this kind of agent/skill security auditing into CI/CD pipelines are likely to increase. The emergence of a standardized classification system like SkillTrustBench can itself be read as a signal that the industry is moving from case-by-case incident response toward routine, ongoing inspection.